IN THE CLAIMS 

Please amend the claims to read as follows: 
Listing of Claims: 

I. (Currently Amended) A network monitoring system that monitors a communication 
within a network including a plurality of terminals, the terminals including at least a client and a 
server, the terminals communicating a plurality of action contents with each other, each action 
content consisting of a group of associated packets, the network monitoring system comprising: 

a data acquisition section that acquires a plurality of packets flown on a network; 

a data analysis section that analyses each of the packets to extract the group of associated 
packets from all the packets and that acquires an action content from the group of associated 
packets, the data analysis section extracting a plurality of groups of the associated packets and 
acquiring a plurality of action contents therefrom; 

a display-information generation section that generates a display information by 
chronologically aligning the plurality of action contents to correspond to respective times when 
the action contents are actually communicated; and 

a display unit that displays an association chart graph indicating the terminals within the 
network and that overlaps s uperimposes additional objects on the association graph chart, the 
additional objects being generated in accordance with the display, the additional objects being 
superimposed overlapped on the association chart graph in a chronological order along with a 
real time sequence of when eommunieation -e- f the action contents are actually communicated . 





wherein the additional objects include 



the type of operating system employed by the client, 



the type of operating system employed by the server, 
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an account name of a user accessing the client, and 
an icon representing the account name. 

2. (Previously Presented) The network monitoring system according to claim 1, wherein 
the action content is defined in advance. 

3. (Previously Presented) The network monitoring system according to claim 1 , wherein 
the data analysis section identifies kinds of the packets acquired by the data acquisition section 
and acquires the action content from the packets on the basis of the identified kinds of the 
packets, 

4. (Previously Presented) The network monitoring system according to claim 1, wherein 
the action content includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

5. (Previously Presented) The network monitoring system according to claim 1 , further 
comprising: 
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an analysis data storage section that stores the action content acquired by the data 
analysis section, wherein: 

the display-information generation section regenerates the information of the sequence of 
individual actions that occurred on the network from the action content stored by the analysis 
data storage section. 

6, (Previously Presented) The network monitoring system according to claim 5, wherein: 
the action content stored by the analysis data storage section includes time information, 

which corresponds to the time at which the single action occurred; and 

the display- information generation section determines the time interval, within the 
sequence, that each individual action occurred using the time information stored by the analysis 
data storage section. 

7. (Previously Presented) The network monitoring system according to claim 5, wherein 
the display-information generation section continuously regenerates the sequence after each 
predetermined period, which period is accurate within 500 milliseconds. 

8, (Previously Presented) The network monitoring system according to claim 1, wherein 
the display-information generation section extracts and generates the information of each action 
occurring on the network in accordance with a display setting set by a user. 

9. (Currently Amended) A network monitoring method for monitoring a communication 
within a network including a plurality of terminals, the terminals including at least a client and a 
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server, the terminals communicating a plurality of action contents with each other, each action 
content consisting of a group of associated packets, the method comprising: 
acquiring a plurality of packets flown on a network; 

analyzing each of the packets to extract the group of associated packets from all the 
packets and acquiring an action content from the group of associated packets, and extracting a 
plurality of groups of the associated packets and acquiring a plurality of action contents 
therefrom; 

generating display information by chronologically aligning the plurality of action 
contents to correspond to respective times when the action contents are actually communicated; 
and 

a display unit that displays an association graph indicating the terminals within the 
network and that overlaps additional objects on the association graph, the additional objects 
being generated in accordance with the display, the additional objects being overlap p ed on the 
associatio n gra ph in a chronological orde r along w ith a sequence of when the actio n contents are 
actually communicated , 

wherein the additional objects include 

the type of operating system employed by the client, 

the type of operating system employed by the server, 

an account name of a user accessing the client, and 

an icon representing the account name. 

10. (Previously Presented) The network monitoring method according to claim 9, 
wherein the action content is defined in advance. 
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1 1 . (Previously Presented) The network monitoring method according to claim 9, 
wherein in the acquisition of the action content, kinds of the packets acquired by the packet 
acquisition are identified and the action content is acquired from the packets on the basis of the 
identified kinds of the packets. 

12. (Previously Presented) The network monitoring method according to claim 9, 
wherein the action content includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

13. (Previously Presented) The network monitoring method according to claim 9, further 
comprising: 

storing the acquired action content, wherein: 

the information of the sequence of individual actions that occurred on the network is 
regenerated from the stored action content. 



14. 
wherein: 



(Previously Presented) The network monitoring method according to claim 13, 
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the stored action content includes time information, which corresponds to the time at 
which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 

15. (Previously Presented) The network monitoring method according to claim 13, 
further comprising continuously regenerating the sequence after each predetermined period, 
which period is accurate within 500 milliseconds. 

16. (Previously Presented) The network monitoring method according to claim 9, 
wherein the information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 

17. (Currently Amended) A network monitoring program recorded on a computer 
readable medium and executable by a computer, the program making the computer monitor a 
communication within a network including a plurality of terminals, the terminals including at 
least a client and a server, the terminals communicating a plurality of action contents with each 
other, each action content consisting of a group of associated packets, and perform a process 
comprising: 

acquiring a plurality of packets flown on a network; 

analyzing each of the packets to extract the group of associated packets from all the 
packets and acquiring an action content from the group of associated packets, and extracting a 



7 



plurality of groups of the associated packets and acquiring a plurality of action contents 
therefrom; 

generating display information by chronologically aligning the plurality of action 
contents to correspond to respective times when the action contents are actually communicated; 
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a display unit that dis play s an association gra ph indicating the terminals within the 
network and that overlaps additional objects on the association graph, the additional obj ects 
bein g generated in accordance with the display, the additional objects being overlapped on the 
association graph in a chronological order along with a sequence of when the action contents are 
actually communicated, 

wherein the additional objects include 

the type of operating system employed by the client, 

the type of operating system employed by the server, 

an account name of a user accessing the client, and 

an icon representing the account name. 

1 8. (Original) The network monitoring program according to claim 17, wherein the 
action content is defined in advance. 

19. (Previously Presented) The network monitoring program according to claim 17, 
wherein in the acquisition of the action content, kinds of the packets acquired by the packet 
acquisition are identified and the action content is acquired from the packets on the basis of the 
identified, kinds of the packets. 
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20. (Previously Presented) The network monitoring program according to claim 17, 
wherein the action content includes: 

sending source computer information and destination computer information included in a 
connection packet; 

user information included in an authentication packet; 

action object information included in an object specification packet; 

action information included in a command packet; and 

data included in a data packet. 

21 . (Previously Presented) The network monitoring program according to claim 17, 
wherein: 

the process further comprises storing the acquired action content; and 
the information of the sequence of indi vidual actions that occurred on the network is 
regenerated from the stored action content. 

22. (Previously Presented) The network monitoring program according to claim 21, 
wherein: 

the stored action content includes time information, which corresponds to the time at 
which the single action occurred; and 

the time interval, within the sequence, that each individual action occurred is determined 
using the stored time information. 
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23. (Previously Presented) The network monitoring program according to claim 21 , 
wherein the process further comprises continuously regenerating the sequence after each 
predetermined period, which period is accurate within 500 milliseconds. 

24. (Previously Presented) The network monitoring program according to claim 17. 
wherein the information of each action occurring on the network is extracted and generated in 
accordance with a display setting set by a user. 

25. (Previously Presented) The network monitoring system of claim 1 , wherein the 
display unit displays a graphical representation of the communication connection between the 
client and the server. 

26. (Previously Presented) The network monitoring method of claim 9, wherein the 
display unit displays a graphical representation of the communication connection between the 
client and the server, 

27. (Previously Presented) The network monitoring program of claim 17, wherein the 
display unit displays a graphical representation of the communication connection between the 
client and the server. 
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